Self-hosted platform for standing up and running software factories on AWS: complete DevSecOps environments with secure delivery pipelines, supply-chain controls, compliance evidence and multi-tenant governance — in minutes, not months.
Purchasable packs that stack on top of an account’s subscription tier to raise its caps or unlock features — without moving the whole account to a higher tier.
effective[quota] = tierBase[quota] + Σ(bundle.grant × quantity).preview shows a negative line and totalCents is already net.-1.The tier sets the baseline; bundles adjust it. This page is the operator and admin reference for what each bundle grants, how the combo discounts work, how caps pool across teams, and the endpoints and environment overrides for managing them.
Written for org admins and owners buying extra capacity, and for operators configuring the catalog. For the tier baselines bundles build on, see feature tiers; for the org/team model the caps apply to, see Organization Benefits.
BILLING_BUNDLES_ENABLED=true. Self-service purchase is disabled under AWS Marketplace.GET /bundles) and previews a change (POST /subscriptions/:id/addons/preview) to confirm the new effective limits before committing.POST /subscriptions/:id/addons). Stackable packs can be bought in quantity.effective[quota] = tierBase + Σ(grant × quantity) and applies any qualifying combo as a recurring usage credit, using best-combo packing so nothing is discounted twice.| What | Goes to | Via |
|---|---|---|
| The nine tracked quota types | quota service | quota sync |
seats and purchased features (e.g. advanced_reporting) |
platform service | PUT /organization/{orgId}/seat-limit |
| Effective retention windows | reporting service | PUT /api/reports/retention-sync/{orgId}, writing dora_settings |
All three target the account root. Retention is not one of the nine flow quotas — it reuses the tier-baseline + bundle-grant math but rides its own reporting sync leg.
-1, e.g. Team and up on dashboards) stays unlimited. Bundles never shrink it.BILLING_BUNDLES_ENABLED=true. Bundles are hidden unless set.POST /subscriptions/:id/addons/preview returns the new effective limits, so the caps that change are visible in advance.| Variable | Effect |
|---|---|
BILLING_BUNDLES_ENABLED=true |
Master switch — bundles are hidden unless set |
BILLING_BUNDLE_<ID>_MONTHLY / _ANNUAL |
Override a bundle’s price (cents) |
BILLING_BUNDLE_<ID>_GRANT |
Override the grant amount (single-dimension bundles only) |
BILLING_BUNDLE_<ID>_TIERS |
JSON array of tiers allowed to buy the bundle |
BILLING_BUNDLE_SEAT_VOLUME_TIERS |
Tune the Member Seat volume-discount thresholds |
BILLING_COMBO_<COMBO>_MONTHLY / _ANNUAL |
Override a combo’s combined price (cents) — e.g. BILLING_COMBO_ANALYTICS_SUITE_MONTHLY |
<ID> is the bundle id upper-cased: SEAT, PIPELINE_PACK, PLUGIN_PACK, API_PACK, AI_PACK, STORAGE_PACK, LISTING_PACK, RETENTION_PACK, DORA_HISTORY_PACK, ADVANCED_REPORTING, TEAM_USAGE_ANALYTICS, COMPLIANCE_STANDARD, COMPLIANCE_ADVANCED, STAKEHOLDER_REPORTS.
<COMBO> is the combo id upper-cased: ANALYTICS_SUITE, TEAM_GROWTH, COMPLIANCE_SUITE, INSIGHTS_BUNDLE, THROUGHPUT_BUNDLE, SCALE_BUNDLE.
AWS Marketplace: when the billing provider is
aws-marketplace, self-service bundle purchase is disabled — entitlements flow from Marketplace instead, and add-on charges are reported as metered usage (BatchMeterUsage). The retention packs meter as theRetentionPack/DoraHistoryPackdimensions. Combo credits (and other usage-credit discounts) realize on Marketplace by withholding metered usage whenBILLING_METERING_ENABLEDis on — see Billing Discounts → AWS Marketplace. See Environment Variables for the full billing configuration.
Prices are the built-in defaults (USD); annual defaults to 10× monthly.
| Bundle | Grant | Monthly | Annual | Available to | Stackable |
|---|---|---|---|---|---|
| Member Seat | +1 member seat (volume discounts — see below) | $19.99 | $199.90 | Team, Business, Enterprise | ✅ |
| Pipeline Pack | +5 pipelines and +25 plugin builds / period — both, so the 5:1 ratio the tiers hold survives the purchase | $29.99 | $299.90 | Team, Business, Enterprise | ✅ |
| Plugin Pack | +10 plugin builds / period | $11.99 | $119.90 | paid tiers | ✅ (volume) |
| API Pack | +25,000 API calls / period | $11.99 | $119.90 | paid tiers | ✅ (volume) |
| AI Pack | +100 AI calls / period | $11.99 | $119.90 | paid tiers | ✅ (volume) |
| Storage Pack | +10 GB registry storage | $19.99 | $199.90 | all tiers | ✅ |
| Listing Pack | +5 public plugin-ecosystem listings (the listings count quota) |
free | free | paid tiers | ✅ (max 2) |
| Standard Retention Pack | +90 days standard pipeline-event retention | $15 | $150 | all tiers | ✅ (max 7) |
| DORA History Pack | +365 days DORA history and +365 days on the per-org report-query window | $30 | $300 | all tiers | ✅ (max 1) |
| Advanced Reporting (DORA) | unlocks the advanced_reporting feature |
$30 | $300 | Developer, Pro, Team | ❌ |
| Team Usage Analytics | unlocks the team_usage_analytics feature (per-team usage breakdown across the org → team subtree) |
$30 | $300 | Team, Business | ❌ |
| Standard Compliance | unlocks the compliance_standard feature — a curated CI/CD best-practice rule library (~20 rules) |
$29.90 | $299 | Developer, Pro, Team, Business | ❌ |
| Advanced Compliance | unlocks the compliance_advanced feature — curated SOC2 / PCI-DSS / CIS framework libraries — requires Standard Compliance |
$99.90 | $999 | Developer, Pro, Team, Business | ❌ |
| Stakeholder Reports | unlocks the stakeholder_reports feature — saved, scheduled manager-facing reports: frozen period snapshots, review-and-publish, email / in-app / Slack / Teams delivery and expiring share links |
$30 | $300 | Pro, Team, Business | ❌ |
Member Seat and Pipeline Pack are the tier differentiators, so both start at Team — a single-seat Developer or Pro can’t cheaply stack them to undercut Team, and must upgrade instead.
The throughput packs (plugin, API, AI, listing) are not sold on Developer. It is the $0 tier, and any grant worth selling is large next to a free tier’s own rate, so a free account could out-buy a paid one on a single dimension for the price of a pack — a conversion leak rather than expansion revenue. Developer’s path up is an upgrade. Only Storage Pack remains on every tier, because at +10 GB it cannot cross a tier boundary (Developer’s 2 GB + 10 GB is still under Pro’s 25 GB).
Grants are sized against the cheapest tier that can buy them, at roughly a third of its own cap, and no pack may exceed half a buyer’s cap or reach the next tier’s — both enforced by api/billing/test/bundle-sizing.test.ts, which also asserts that assembling the next tier out of packs always costs more than the upgrade.
API Pack tops up a finite API-call cap that every tier has (Team 300k, Business 800k, Enterprise 1.5M per period).
Two ways to add any stackable pack. Each card carries a one-click +1
(labelled in the pack’s own units — +10 GB for storage, +1 for seats) and a
typed field for an exact quantity. The quick-add only fills the field: the
line beneath still reads current → new · cost and nothing is charged until
Add/Update, and it is disabled at the pack’s maxQuantity rather than letting a
click run past it. There is deliberately no one-click remove — a reduction is
destructive, so it goes through the field and a confirmation. That combination is
why the control can exist at all: the bare ±1 stepper it replaced hid both the
resulting quantity and its price, and let a buyer click past the cap into a 400.
Storage is entered in GB, not in packs. The typed field takes an
absolute quantity, and for most packs the number you type is
the number you mean — one seat is one seat. Storage’s grant is 10 GB, so the
field would otherwise ask for “6” to mean 60 GB. It accepts GB in multiples of
the pack size instead, converts to packs on commit, and refuses a value that is
not a whole pack rather than rounding it — rounding up would charge for capacity
nobody asked for, and rounding down would quietly deliver less than was typed.
The step follows the grant, so a deployment that overrides
BILLING_BUNDLE_STORAGE_PACK_GRANT to 20 GB gets a 20 GB step with no code change.
Seats are per-unit ($19.99 each), and the more you buy the cheaper each gets:
| Seats | Discount off the seat line |
|---|---|
| ≥ 5 | 10% |
| ≥ 15 | 20% |
| ≥ 40 | 30% |
The discount is realized as a recurring usage credit, like a combo, so the provider still charges unit × quantity and the credit offsets the balance. The add-on preview shows a negative “Member Seat volume discount” line so totalCents reflects the net. Thresholds are env-tunable via BILLING_BUNDLE_SEAT_VOLUME_TIERS.
Listing Pack raises the listings count quota — the number of active public listings an org’s publisher can hold in the plugin ecosystem. Tier base: Developer 3, Pro 10, Team 25, Business 50, Enterprise 100. Installing plugins is free on every plan and needs no pack.
The pack itself is free. Ecosystem publishing is deliberately not monetized: installing costs nothing on any tier and the Verified trust tier is earned by review rather than bought, so charging for the capacity to publish taxed the one thing that grows the catalog for everyone. It is capped at 2 packs (+10) because a free stackable pack with no ceiling would be self-service unlimited listings, and the quota exists for moderation and registry cost rather than revenue.
Like plugins and pipelines it is a count, so removing packs below the org’s current active-listing count is refused by the over-cap guard. A plan downgrade is different: it is never refused for listings — the listings stay listed, and new versions and listing updates are refused (security fixes excepted) until the org is back under its limit (notice N29). The limit is enforced when a publish request is submitted and again when it is approved; see Plugin Publishing.
Each tier carries a baseline reporting-retention window — paid tiers default to 30 days for standard pipeline events and 180 days for DORA source, while the unlimited tier is unlimited retention (-1, history is never swept).
The two retention packs stack like every other pack: effective retention = tier baseline + Σ(pack grant × quantity). Buy Standard Retention Pack ×2 for +180 days of standard-event history. Billing computes that effective window and syncs it to the reporting service (dora_settings.event_retention_days / dora_retention_days).
The DORA History Pack also widens the per-org report-query window, which now tracks retention and is capped at an absolute 730 days — so a pack holder can actually query the extended range, not just retain the raw rows. It only does anything useful alongside Advanced Reporting (DORA).
advanced_reporting, but a report’s DORA panels do not. An add-on whose headline numbers are locked behind a second purchase is not what its own description promises.entitlement, including reports owned by teams under the root — entitlement is pooled at the root, so pausing only the root would leave the teams running on a cancelled subscription. Published snapshots stay readable and existing share links live until they expire; no new link is minted and nothing new is delivered. Re-subscribing resumes exactly what the lapse paused; a report paused because its owner was deactivated stays paused. Upgrading to Enterprise prunes the charge and keeps the capability.Standard / Advanced Compliance unlock curated compliance-content libraries (see Compliance → Curated content add-ons). Both are purchasable on Developer / Pro / Team and included on Enterprise / Unlimited, where there is nothing to buy.
Advanced requires Standard. The purchase route rejects adding Advanced alone (400), so buy Standard first and add Advanced, or buy the Compliance Suite combo to get both at once. Cancelling Standard while Advanced is held cascade-cancels Advanced.
These bundles gate only the curated libraries — authoring your own org rules stays free and ungated on every tier.
Advanced Reporting and Team Usage Analytics are the “buy a capability without changing tier” path. Each is standard from Enterprise up, and the bundle lets a lower tier add it à la carte — so the add-on is offered only to the tiers that don’t already include it: Advanced Reporting to Developer/Pro/Team, Team Usage Analytics to Team, since Developer and Pro can’t nest teams and so have nothing to break down.
SSO is not an add-on. It is a tier feature from Team up, and there is deliberately no way to buy it below that. It used to be a $40/mo Pro-only bundle, which was both dominated and broken: Pro ($39) plus the add-on cost exactly Team ($79), which includes SSO and teams and domain registration; and SSO needs a DNS-verified email domain, which is itself a Team-and-up tier check — so a Pro buyer’s Okta / Entra / generic-OIDC / SAML connection failed at callback with OIDC_EMAIL_DOMAIN_NOT_VERIFIED. A lower tier that needs SSO upgrades to Team; the UI’s sso lock links to the Plans tab rather than to an add-on. See Authentication → Per-org enterprise SSO.
Verified publishing is not sold. The verified_publisher feature (Team, Business, Enterprise and billing-off instances) only makes an org eligible to apply for the Verified badge; the system org awards it after review. No bundle adds it. A Verified publisher whose plan drops below Team keeps the badge for a 30-day grace period, then returns to Community.
Some add-ons are cheaper bought together. When an account holds every member of a combo, each at or above its minimum quantity, the set is billed at a reduced combined price instead of the sum of the members — and the difference is realized as a recurring usage credit (never a provider coupon), consistent with the discount model.
| Combo | Members | Buy separately | Together | You save |
|---|---|---|---|---|
| Analytics Suite | Advanced Reporting (DORA) + Team Usage Analytics + Stakeholder Reports | $90 / mo · $900 / yr | $63 / mo · $630 / yr | $27 / mo · $270 / yr |
| Team Growth Bundle | ≥ 5 Member Seats + Team Usage Analytics | $129.95 / mo · $1,299.50 / yr | $90.99 / mo · $909.90 / yr | $38.96 / mo · $389.60 / yr |
| Compliance Suite | Standard Compliance + Advanced Compliance | $129.80 / mo · $1,298 / yr | $90.86 / mo · $908.60 / yr | $38.94 / mo · $389.40 / yr |
| Insights Bundle | Team Usage Analytics + Stakeholder Reports | $60 / mo · $600 / yr | $42 / mo · $420 / yr | $18 / mo · $180 / yr |
| Throughput Bundle | Plugin Pack + API Pack + AI Pack | $35.97 / mo · $359.70 / yr | $25.18 / mo · $251.80 / yr | $10.79 / mo · $107.90 / yr |
| Scale Bundle | API Pack + Storage Pack | $31.98 / mo · $319.80 / yr | $22.39 / mo · $223.90 / yr | $9.59 / mo · $95.90 / yr |
How it works:
Team Growth Bundle discount −$38.96), so totalCents already reflects the net.It is realized as a recurring usage credit re-granted each billing period, derived fresh from the current add-on composition — the invoice reconciler grants Σ member price × minQty − combined price (clamped ≥ 0) per period, idempotent per invoice. Existing qualifying accounts begin receiving the credit at their next invoice, retroactive by design.
Why there is both an Analytics Suite and an Insights Bundle. A combo only applies when the account holds every member, and advanced_reporting is included in Business — so Business cannot buy that member and the three-member Suite can never form there. Without the Insights Bundle a Business account buying the other two paid full list ($60) while a Team account paid $63 for all three. The Insights Bundle is the same pair minus the member the tier already owns, and on Team it simply loses to the Suite’s larger credit.
combo_expired billing event. The preview warns “Ends your Team Growth Bundle discount — −$38.96/mo” before you commit.Proration note. A mid-period seat increase is prorated by the provider at the full unit price; the volume-discount credit reconciles at the next invoice, so the discount lags one cycle on the proration amount, then catches up automatically. Steady state — full billing periods — is unaffected.
Combos are only advertised when every member is purchasable on the account’s tier. Developer, for example, can’t buy Team Usage Analytics, so it isn’t offered either combo.
For an account with teams, bundle grants raise the root account’s pooled caps, and the whole subtree draws from that shared pool:
Bundles are managed through the billing service — the dashboard Billing page or the API. Mutations require an org admin/owner.
| Action | Endpoint |
|---|---|
| List available bundles | GET /bundles |
| Preview the effect of an add-on change | POST /subscriptions/:id/addons/preview |
| Add / change an add-on | POST /subscriptions/:id/addons |
| Remove an add-on | DELETE /subscriptions/:id/addons/:bundleId |
| Open the billing portal | POST /portal |
The preview endpoint returns the new effective limits before you commit, so you can confirm exactly which caps change.